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REMARKS 

This Application has been carefully reviewed in light of the Office Action 
electronically mailed August 22, 2008. Claims 1-5, 7-10, 12-21, 23-26, 28-37, 39-42, and 
44-60 are currently pending. Applicant respectfully requests reconsideration and allowance 
of all pending claims. 

Rejections under 35 U.S.C. § 103 

The Office Action rejects Claims 1-5, 12-21, 28-37, and 44-48 under 35 U.S.C. 
§103(a) as being unpatentable over McGee in view of U.S. Patent No. 5,440,723 issued to 
Arnold et al. (^Arnold"). Applicant respectfully traverses these rejections. 

Claim 1 is directed to a method for maintaining computer security. The method 
includes providing a database of known good software and a database of unfamiliar software. 
The method further includes, for the identified file, determining whether an entry exists in the 
database of known good software and determining whether an entry exists in the database of 
unfamiliar software. The method further includes moving the entry from the database of 
unfamiliar software to the database of known good software if it is determined that the entry 
has been in the database of unfamiliar software for a sufficient period of time. Applicant 
respectfully contends that the proposed McGee-Arnold combination fails to disclose, teach, or 
suggest each and every one of these limitations. 

The Office Action relies on Arnold for disclosing the limitations "providing a 
database of unfamiliar software" and "moving the entry from the database of unfamiliar 
software to the database of known good software if it is determined that the entry has been in 
the database of known good software for a sufficient period of time." Office Action, pg. 5. 
Applicant respectfully contends that this reliance is misplaced. 

For instance, the Office Action relies on column 29, lines 18-25 of Arnold as 
disclosing a database of unfamiliar software. Office Action, pg. 5. However, the cited 
portion clearly states that "a valid signature of the previously unknown type of undesirable 
software entity is stored within the [signature database] SDB 74a for subsequent use by the 
scanner 74." Arnold, col. 29, lines 19-22. Therefore, the signature database disclosed by 
Arnold contains valid signatures of known undesirable software. Thus, Applicant 
respectfully contends that this database fails to disclose "a database of unfamiliar software." 
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The Office Action additionally relies on Figure 2, elements B and C of Arnold as 
disclosing this limitation. Office Action, pg. 2. This reliance is also misplaced. The mere 
presence of an unknown virus does not disclose, teach, or suggest providing a database of 
unfamiliar software. In fact, the only database disclosed in Arnold is signature database SDB 
74a, which stores the signatures of known viruses. Arnold, col. 28, lines 55-60. 

Furthermore, the Office Action relies on Figure 2, step E and Figure 3, step O of 
Arnold for disclosing the limitation "moving the entry from the database of unfamiliar 
software to the database of known good software if it is determined that the entry has been in 
the database of unfamiliar software for a sufficient period of time." Office Action, pg. 5. 
Applicant respectfully contends that this reliance is also misplaced. 

For instance, these steps both disclose extracting an identifying signature from a 
suspected virus and adding the signature to signature database SDB. See Arnold, col. 2, lines 
63-65. As shown above, this signature database stores the signatures of known viruses . This 
clearly fails to disclose, teach or suggest moving an entry to a database of known good 
software . 

The Office Action additionally relies on column 6, lines 24-36 of Arnold as disclosing 
the limitation "for a sufficient period of time." Office Action, pg. 2. Applicant respectfully 
contends that this reliance is also misplaced. The cited portion discloses that "[a]fter a 
specified time interval . . . checksums of some or all of the decoy programs are taken and 
compared directly to their originals" to determine if a virus has been detected. Arnold, col. 6, 
lines 24-28. However, "[i]f none of the decoys are found to have changed, the user is alerted 
to the fact that an anomaly of some sort was detected, but that the system was unable to find 
conclusive evidence of a virus. In this case it is desirable to maintain the system in a 
moderate state of alert for some time period, exercising the decoy programs at a reduced 
priority or less frequent intervals." Arnold, col. 6, lines 29-36. Therefore, Arnold discloses 
exercising decoy programs at "specified time intervals" to detect viruses. This fails to 
disclose, teach, or suggest " moving the entry from the database of unfamiliar software to the 
database of known good software if it is determined that the entry has been in the database of 
unfamiliar software for a sufficient period of time ." For at least these reasons, Applicant 
respectfully requests reconsideration and allowance of Claim 1 . 

Claims 2-5 and 12-16 depend, either directly or indirectly, from Claim 1 and 
incorporate all the limitations thereof. Therefore, for at least the reasons discussed above 
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with regard to Claim 1, Applicant respectfully requests reconsideration and allowance of 
Claims 2-5 and 12-16. 

Similar to Claim 1, Claims 17 and 33 include limitations related to providing a 
database of unfamiliar software and moving the entry from the database of unfamiliar 
software to the database of known good software if it is determined that the entry has been in 
the database of unfamiliar software for a sufficient period of time. For at least those reasons 
discussed above with regard to Claim 1 , Applicant respectfully requests reconsideration and 
allowance of Claims 17 and 33. 

Claims 18-21 and 28-32 depend, either directly or indirectly, from Claim 17 and 
incorporate all the limitations thereof. Claims 34-37 and 44-48 depend, either directly or 
indirectly from Claim 33 and incorporate all the limitations thereof. Therefore, for at least 
the reasons discussed above, Applicant respectfully requests reconsideration and allowance 
of Claims 18-21, 28-32, 34-37, and 44-48. 

The Office Action rejects Claims 7, 23, and 39 under 35 U.S.C. §103(a) as being 
unpatentable over McGee in view of Arnold and further in view of Liu. The Office Action 
rejects Claims 10, 26, and 42 under 35 U.S.C. § 103(a) as being unpatentable over McGee and 
of Arnold in view of Liu and further in view of Verma. The Office Action rejects Claims 8-9, 
24-25, 40-41, 49, 51, and 54 under 35 U.S.C. §103(a) as being unpatentable over McGee in 
view of Arnold in further view of Verma. The Office Action rejects Claims 50, 52 and 55 
under 35 U.S.C. 103(a) as being unpatentable over McGee in view of Arnold and Verma in 
further view of Christenson. Applicant respectfully traverses these rejections. 

Claims 7-10 and 49-50 each depend, either directly or indirectly, from Claim 1 and 
incorporate all the limitations thereof. Claims 23-26, 29, and 51-52 each depend, either 
directly or indirectly, from Claim 17 and incorporate all the limitations thereof. Claims 39-42 
and 54-55 each depend, either directly or indirectly, from Claim 33 and incorporate all the 
limitations thereof. As shown above, the proposed McGee-Arnold combination fails to 
disclose, teach, or suggest each and every limitation of Claims 1,17, and 33. Neither Liu, 
Verma, nor Christenson cure these deficiencies. Therefore, Applicant respectfully requests 
reconsideration and allowance of Claims 7-10, 23-26, 29, 39-42, 49-52, and 54-55 for at least 
the same reasons as their respective base claims. 
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The Office Action rejects Claims 56-60 under 35 U.S.C. § 103(a) as being 
unpatentable over McGee in view of Verma and further in view of Arnold. Applicant 
respectfully traverses these rejections. 

Claim 56 is directed to a method for computer security. The method includes 
identifying a file. The method also includes determining quantitative information regarding 
the file, the quantitative information selected from the group consisting of a length of time the 
entry has been in the database of unfamiliar software, a number of times the file has been 
opened, and a number of times an executable in the file has been executed. The method 
further includes adding an entry for the file to a database of known good software if the 
quantitative information exceeds a predetermined value. Applicant respectfully contends that 
the proposed McGee-Verma-Arnold combination fails to disclose, teach, or suggest each and 
every one of these limitations. 

As shown above, Arnold discloses "a valid signature of the previously unknown type 
of undesirable software entity is stored within the [signature database] SDB 74a for 
subsequent use by the scanner 74." Arnold, col. 29, lines 19-22. Therefore, the signature 
database disclosed by Arnold contains valid signatures of known undesirable software. Thus, 
Applicant respectfully contends that this database fails to disclose a "database of unfamiliar 
software." 

McGee discloses a "generated hash value with the stored hash values on the approved 
hash list ." McGee, col. 11, lines 40-46 (emphasis added). Applicant respectfully contends 
that this "approved hash list" is not a database of unfamiliar software. In fact, the Office 
Action even admits that McGee fails to disclose "providing a database of unfamiliar 
software." Office Action, pg. 5. Therefore, Applicant respectfully contends that McGee also 
fails to disclose, teach, or suggest determining whether an entry for a file exists in a database 
of unfamiliar software . Verma fails to cure these deficiencies of Arnold and McGee. 

Furthermore, Applicant respectfully contends that McGee fails to disclose, teach, or 
suggest "adding an entry for the file to a database of known good software if the quantitative 
information exceeds a predetermined value." As described above, McGee discloses 
comparing a hash value generated for a program with a list of stored hash values on an 
approved list. If a match is found, the program is allowed to execute. McGee, col. 1 1 , lines 
46-49. However, if there is no match, the system prevents the executable file data from 
executing. McGee, col. 11, lines 54-57. This does not disclose, teach, or suggest quantitative 
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information or a predetermined value. Furthermore, it fails to disclose, teach, or suggest 
adding an entry to a database of known good software if the quantitative information exceeds 
a predetermined value. Verma and Arnold fail to cure these deficiencies. For at least these 
reasons, Applicant respectfully requests reconsideration and allowance of Claim 56. 

Claims 57-60 depend, either directly or indirectly from Claim 56 and incorporate all 
the limitations thereof. As shown above, the proposed McGee-Verma-Arnold combination 
fails to disclose, teach, or suggest each and every element of Claim 56. Therefore, for at least 
the reasons discussed above, Applicant respectfully requests reconsideration and allowance 
of Claims 57-60. 
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Conclusion 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other apparent reasons, Applicant respectfully requests full 
allowance of all pending Claims. If the Examiner feels that a telephone conference or an 
interview would advance prosecution of this Application in any manner, the undersigned 
attorney for Applicant stands ready to conduct such a conference at the convenience of the 
Examiner. 

Although Applicant believes no fee is due, the Commissioner is hereby authorized to 
charge any required fee or credit any overpayment to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 




Luke K. Pedersen 
Reg. No. 45,003 
PHONE: (214) 953-6655 



Date: 



CORRESPONDENCE ADDRESS: 
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